Run composer install after adding a patch

README.md

@@ -47,6 +47,13 @@ Example:
 composer patch-add drupal/core "SA-CORE-2018-002" "https://cgit.drupalcode.org/drupal/rawdiff/?h=8.5.x&id=5ac8738fa69df34a0635f0907d661b509ff9a28f"
 ```
 
+The patch add command accepts the following options.
+
+* `--no-update` Use this option to prevent composer to update the package and apply the patch. The patch will only end
+up in your `composer.json`, not `composer.lock` file.
+
+* `--update-no-dev` Run the dependency update with the --no-dev option.
+
 You can omit arguments for an interactive mode.
 
 ### Patch List

src/Composer/PatchAddCommand.php

@@ -4,9 +4,11 @@
 
 use Symfony\Component\Console\Input\InputInterface;
 use Symfony\Component\Console\Input\InputArgument;
+use Symfony\Component\Console\Input\InputOption;
 use Symfony\Component\Console\Output\OutputInterface;
 use Composer\Json\JsonFile;
 use Composer\Json\JsonManipulator;
+use Composer\Installer;
 
 class PatchAddCommand extends PatchBaseCommand {
 
@@ -17,6 +19,8 @@ protected function configure() {
         new InputArgument('package', InputArgument::REQUIRED),
         new InputArgument('description', InputArgument::REQUIRED),
         new InputArgument('url', InputArgument::REQUIRED),
+        new InputOption('no-update', null, InputOption::VALUE_NONE, 'Do not run an update: as side effect patch will not be applied.'),
+        new InputOption('update-no-dev', null, InputOption::VALUE_NONE, 'Run the dependency update with the --no-dev option.'),
       ]);
 
     parent::configure();
@@ -44,6 +48,7 @@ protected function execute(InputInterface $input, OutputInterface $output) {
     $package = $input->getArgument('package');
     $description = $input->getArgument('description');
     $url = $input->getArgument('url');
+    $updateDevMode = !$input->getOption('update-no-dev');
 
     // Validate the patch url argument.
     if (filter_var($url, FILTER_VALIDATE_URL) === FALSE) {
@@ -78,6 +83,27 @@ protected function execute(InputInterface $input, OutputInterface $output) {
     file_put_contents($config->getPatchesFile(), $manipulator->getContents());
 
     $output->writeln('The patch was successfully added.');
+
+    if (!$input->getOption('no-update')) {
+      // Trigger install command after adding a patch.
+      $install = Installer::create($this->getIO(), $this->getComposer());
+
+      // We run an update, because the patch will otherwise not end up in the
+      // composer.lock. Beware: This could update the package unwanted.
+      $install->setUpdate(TRUE)
+        // Forward the option
+        ->setVerbose($input->getOption('verbose'))
+        // Only update the current package
+        ->setUpdateWhitelist([$package])
+        // Don't update the dependencies of the patched package.
+        ->setWhitelistTransitiveDependencies(FALSE)
+        ->setWhitelistAllDependencies(FALSE)
+        // Patches are always considered to be applied in "dev mode".
+        // This is also required to prevent composer from removing all installed
+        // dev dependencies.
+        ->setDevMode($updateDevMode)
+        ->run();
+    }
   }
 
 }